CVE-2024-3273:

A remote, unauthenticated command-injection vulnerability exists in the HTTP GET Request Handler nas_sharing.cgi of D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L devices, allowing arbitrary commands to be executed by manipulating the system argument (CWE-77); the flaw is rated high severity with a CVSS base score of 7.3 and affects firmware version 20240403 on the listed models.

This CVE describes a critical remote command-injection vulnerability in the D-Link NAS devices DNS-320L, DNS-325, DNS-327L, and DNS-340L, located in the nas_sharing.cgi component's HTTP GET request handler. By manipulating the system argument, an attacker can inject and execute commands on the device without authentication, potentially compromising the device and related network resources. The flaw is associated with CWE-77 (Command Injection) and has a CVSS base score of 7.3 (HIGH) for both CVSS v3.0 and v3.1. The advisory notes that the affected firmware is 20240403 and that the products are end-of-life with no available patch from the vendor, increasing the risk profile. Public disclosure and available exploit information further elevate the urgency of mitigation, though remediation options are limited by the vendor’s discontinued support.